Ytdyklly

For my local work environment I would like to access all my companies server directly from my workstation elsewhere.
To make this really fun the only access possible is via the VPN on the company managed notebook and the notebook does not allow connections to the local network.

Obviously, no IT department is helping you with such a problem.

If you can SSH to the company notebook from your home computer then you can use SSH Tunnelling or SSH Jump Hosts

There is a lot of ssh tunnneling documentation, but they dont cover this specific scenario.

So to get from
Workstation <-> Notebook <-> Company Network
we need an extra system on N which plays the router to connect the separate networks.

We need an additional VM on the Notebook with 2 network ports.
One is connected to the host network via NAT,
the other connected to the LAN via a bridged connection.

So we can get a connection as
W <-> VM1 <-> VM2 <-> N1 <-> N2 <-> CN

This can be configured via ssh config.
An example with some bogus IPs.

W =   192.0.0.3   <LAN>      VM1 = 192.0.0.2

VM1 = 192.0.0.2   <route>    VM2 = 10.0.0.3

VM2 = 10.0.0.3    <NAT>      NATRouter = 10.0.0.1

NR =  10.0.0.1    <nat2host> N1 = 20.0.0.4

N2 = 20.0.0.4     <vpnroute> CN 0.0.0.0/0

This is the description of the network hops between the system.

So to connect to a server in the CN we need to solve 2 separate steps.
We need to setup ssh configurations for the intermediate hops.
.ssh/config entries:

# reaching the VM

Host VM

    User            vmuser

    IdentityFile    ~/.ssh/vm_id_rsa

    ForwardX11      yes



# reaching a host inside the CN

Host CNhost

    User            companyuser

    IdentityFile    ~/.ssh/cnhost_id_rsa

    ForwardX11      yes

    ProxyCommand    ssh -A vm nc %h %p 2>  /dev/null    

Another important issue is the correct routing within the VM.
The route to the bridged LAN 192.0.0.0/24 needs to have a lower metric than the default route to the NAT 10.0.0.1.

vm$ ip route

default via 10.0.0.1 metric 100

10.0.0.0/24 dev nat1 metric 100

192.0.0.0/24 dev bridge1 metric 99

Now the interesting case is when we want to also access a server on an internal network which is accessible only from a server already inside the company network.
A classical jumphost configuration.
For that we need another .ssh/config entry

# reaching a host on a CN internal network

Host CNInternalhost

    User            cnInternalUser

    IdentityFile    ~/.ssh/cninternalhost_id_rsa

    ForwardX11      yes

    ProxyCommand    ssh -A CNhost nc %h %p 2>  /dev/null

Now we should be able to simply ssh into the CNInternalhost.

If not the routeing tables need to be checked. (e.g. missing routes or wrong metrics)

But we also want to access a service on this internalhost directly from our local workstation!

For this we now create the tunnel using the hops preconfigured in the .ssh/config

ssh -L <portOnLocalhost>:CNInternalhost:<portOnCNInternalHost> CNhost

Now we can access CNInternalhost: < portOnCNInternalHost > on localhost:< portOnLocalhost >

If we want to reuse an additional network name (ServerX) in our local setup, we can add a host alias on our local host for our LAN ip and create an additional tunnel for it.

echo 192.0.0.3 ServerX >> /etc/hosts

This also requires an additonal .ssh/config entry:

# configuring another host on the CN internal network

Host serverX

    User            cnInternalUser

    IdentityFile    ~/.ssh/serverX_id_rsa

    ForwardX11      yes

    ProxyCommand    ssh -A CNhost nc %h %p 2>  /dev/null

with this ssh config we can now create a tunnel like this

ssh -L serverX:<portOnLocalhost>:serverX:<portOnLocalhost> CNhost

as long as serverX is accessible from CNhost.

And we can do a:

$ wget serverX:<portOnLocalhost>